@cotal-ai/manager 0.72.1 → 0.76.0

package/dist/manager.js

@@ -4,11 +4,11 @@ import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
 import Headless from "@xterm/headless";
-import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
-import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
-import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
+import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, injectedSecretStoreIdentity, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
+import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimIdentityRecord, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceKey, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
+import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, watchProvedExit, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
-import { DELIVERY_ADMIN_BOOT_WAIT_MS, isUnansweredDeliveryAdmin, makeManagerEndpointEvictionEvidence, makeManagerEndpointHolderEvictor, untilDeliveryAdminAnswers } from "./endpoint-evict.js";
+import { DELIVERY_ADMIN_BOOT_WAIT_MS, isUnansweredDeliveryAdmin, makeManagerEndpointEvictionEvidence, makeManagerEndpointHolderEvictor, untilDeliveryAdminAnswers, withScopedEndpoint } from "./endpoint-evict.js";
 import { makeManagerHolderLivenessProbe } from "./holder-liveness.js";
 import { GateReconcileRefused, reconcileEndpointGate } from "./reconcile-gate.js";
 import { launchSpecForRun, materializePersona, launchAgentToStartOpts, parseLaunchSpec, persistLaunchSpec, readContinuityAssignment, writeContinuityAssignment } from "./launch.js";
@@ -294,14 +294,6 @@ function resolveHarness(name, requires) {
     }
     return missing.length ? { binaries, reason: `${name} harness needs ${missing.join(", ")} on PATH - not found` } : { binaries };
 }
-function injectedManagerStoreIdentity(store) {
-    if (store.identity !== undefined)
-        return parseSecretStoreIdentity(store.identity);
-    const coordinate = process.env.COTAL_SECRET_STORE;
-    if (!coordinate)
-        throw new Error("ManagerOptions.secretStore must declare its identity or set COTAL_SECRET_STORE so the manager and delivery daemon can name the same authority (never a silent local-root fallback)");
-    return { kind: "injected", coordinate };
-}
 /** True only when the delivery-admin rail has no bound responder. A timeout is a hung rail, not absence. */
 function isAbsentDeliveryAdmin(msg) {
     if (/timeout/i.test(msg))
@@ -341,7 +333,7 @@ export class Manager {
     secretStoreIdentity;
     /** See {@link ManagerOptions.installedExtensions}. */
     installedExtensions;
-    runtime;
+    executionState;
     /** Internal test seam. Production leaves this undefined and uses the scoped delivery-admin evictor. */
     staticLifecycleEvict;
     preserveStopTimeoutMs;
@@ -629,7 +621,13 @@ export class Manager {
         return dialerFor(servers)({ ...opts, servers });
     }
     constructor(opts) {
-        if (opts.pooled && (!opts.remoteAuthority || opts.runtime === undefined || opts.runtime === "auto" || opts.runtime === "pty"))
+        if (opts.execution !== undefined && opts.execution !== "runtime" && opts.execution !== "none")
+            throw new Error(`unknown manager execution capability ${JSON.stringify(opts.execution)}`);
+        if (opts.execution === "none" && (!opts.pooled || !opts.remoteAuthority || opts.runtime !== undefined))
+            throw new Error("execution: none requires pooled signerless remote authority and no runtime option");
+        if (opts.execution === "none" && ["renewExecutor", "renewStandingBundle", "mintSessionServing", "mintRetirementRequester", "prepareAgentRetirement", "validateRetainedAgent", "scanGoalIndex", "authorizeAdmin"].some((key) => typeof opts.remoteAuthority?.[key] !== "function"))
+            throw new Error("execution: none requires complete closed remote authority callbacks before construction");
+        if (opts.pooled && (!opts.remoteAuthority || (opts.execution !== "none" && (opts.runtime === undefined || opts.runtime === "auto" || opts.runtime === "pty"))))
             throw new Error("pooled control requires signerless remote authority and an explicit non-PTY runtime; local custodial execution is forbidden");
         if (opts.pooled && !opts.remoteAuthority?.renewStandingBundle)
             throw new Error("pooled control requires a closed host-issued all-duty renewal callback before construction");
@@ -649,11 +647,13 @@ export class Manager {
             this.managerLifecycleUid = opts.remoteAuthority.lifecycleUid;
         this.secrets = opts.secretStore ?? workspaceSecretStore(this.workspaceRoot);
         if (opts.secretStore)
-            this.secretStoreIdentity = injectedManagerStoreIdentity(opts.secretStore);
+            this.secretStoreIdentity = injectedSecretStoreIdentity(opts.secretStore);
         this.installedExtensions = opts.installedExtensions ?? false;
-        this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
-        if (opts.pooled && isCustodialRuntime(this.runtime))
-            throw new Error(`pooled control refuses custodial runtime "${this.runtime.kind}" before starting agents`);
+        this.executionState = opts.execution === "none" ? { kind: "none" } : { kind: "runtime" };
+        if (this.executionState.kind === "runtime")
+            this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
+        if (opts.pooled && this.executionState.kind === "runtime" && isCustodialRuntime(this.requiredRuntime))
+            throw new Error(`pooled control refuses custodial runtime "${this.requiredRuntime.kind}" before starting agents`);
         this.preserveStopTimeoutMs = opts.preserveStopTimeoutMs ?? PRESERVE_STOP_TIMEOUT_MS;
         this.endpointServeExecutorExpiresInSeconds = opts.endpointServeExecutorExpiresInSeconds;
         if (opts.resumeAttemptId && !/^[A-Za-z0-9_-]{1,128}$/.test(opts.resumeAttemptId))
@@ -681,18 +681,34 @@ export class Manager {
         opts.attachHost ?? "127.0.0.1");
     }
     get runtimeKind() {
-        return this.runtime.kind;
+        return this.executionState.kind === "none" ? "none" : this.requiredRuntime.kind;
+    }
+    get execution() {
+        return this.executionState.kind;
+    }
+    executionRefusal() {
+        return "execution: none forbids seat launch and workflow hosting on this control instance; select the participant Manager with an instance-pinned manager-caller view";
+    }
+    /** A defensive last barrier, not a substitute Runtime. Entry admission runs before effects. */
+    get requiredRuntime() {
+        if (this.executionState.kind === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
+        return this.runtime;
     }
     /** What a default process stop does with this manager's seats. `release` drops manager-local
      *  custody and leaves every seat running. `stop` means this runtime keeps its PTYs inside the
      *  manager process, so those seats close with it: the stop stops and deprovisions them, and still
      *  releases every seat that can outlive it. */
     get spareSeats() {
-        return this.runtime.kind !== "pty" || this.runtime.supportsRelease === true ? "release" : "stop";
+        if (this.execution === "none")
+            return "release";
+        return this.requiredRuntime.kind !== "pty" || this.requiredRuntime.supportsRelease === true ? "release" : "stop";
     }
     /** Reattach this manager's runtime to a durable handle. Refuses by name when adopt is absent. */
     adoptRuntimeHandle(reference) {
-        return requireRuntimeAdopt(this.runtime, reference);
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
+        return requireRuntimeAdopt(this.requiredRuntime, reference);
     }
     /** The console page URL (manager-hosted, loopback). */
     get consoleUrl() {
@@ -795,7 +811,34 @@ export class Manager {
         this.startTask = wrapped;
         return wrapped;
     }
+    async admitExecutionState() {
+        if (this.remoteAuthority) {
+            // Execution is fixed for a registered instance. An older instance with no capability
+            // record might own retained seats/runs, so it cannot be converted to none by omission.
+            const remote = this.remoteAuthority;
+            const path = join(this.workspaceRoot, ".cotal", `manager-execution.${spaceKey(this.space)}.${remote.instanceId}.json`);
+            if (this.execution === "none" && !existsSync(path) && remote.serveGrant.epoch !== 0)
+                throw new Error("execution: none refuses an existing unclassified manager instance; keep its runtime and retained state, or register a fresh control instance");
+            if (this.execution === "none") {
+                const entries = await remote.scanGoalIndex();
+                if (entries.some((entry) => entry.iid === remote.instanceId && (entry.allocated !== undefined || entry.note !== undefined)))
+                    throw new Error("execution: none refuses retained seat or turn inventory before recovery; keep the execution-owning Manager");
+            }
+            if (this.execution === "none" || existsSync(path)) {
+                const record = claimIdentityRecord(path, "manager execution capability", (raw) => {
+                    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+                        return undefined;
+                    const r = raw;
+                    return Object.keys(r).sort().join(",") === "execution,instanceId,space,v" && r.v === 1 && r.space === this.space &&
+                        r.instanceId === remote.instanceId && (r.execution === "none" || r.execution === "runtime") ? r : undefined;
+                }, () => ({ v: 1, space: this.space, instanceId: remote.instanceId, execution: this.execution }));
+                if (record.execution !== this.execution)
+                    throw new Error("manager execution capability differs from its retained instance record; execution cannot change across restart");
+            }
+        }
+    }
     async runStart() {
+        await this.admitExecutionState();
         this.staticReconcileStopping = false;
         await this.inspectConnectorsAtBoot();
         await this.attach.start();
@@ -842,9 +885,10 @@ export class Manager {
         // dir) - two managers in ONE space are two workspace roots.
         //
         // First mint on a fresh root is exclusive create (#1263). Two processes that both observe no
-        // file must not keep different in-memory ids: of N concurrent starts exactly one creates the
-        // file (`link` / O_EXCL) and the others adopt that identity before taking a lease, or refuse
-        // with identity-record-create-lost. Atomic rename is not enough, because the loser
+        // file must not keep different in-memory ids: of N concurrent starts exactly one publishes the
+        // file by hard link and the others adopt that identity before taking a lease, or refuse with
+        // identity-record-create-lost. A filesystem without hard links refuses the first start with
+        // atomic-publish-unsupported. Atomic rename is not enough, because the loser
         // of a replace would still serve under the id it minted.
         {
             if (this.remoteAuthority) {
@@ -921,7 +965,7 @@ export class Manager {
         this.ep.on("roster", () => this.logSeatMeshTransitions());
         this.ep.on("presence-view", () => this.logSeatMeshTransitions());
         await this.ep.start();
-        await this.ep.setActivity(`supervisor (${this.runtime.kind})`);
+        await this.ep.setActivity(`supervisor (${this.runtimeKind})`);
         // Per-instance liveness lease (P2 item 3 — the old per-space singleton is DEMOTED per D9). Acquire
         // THIS logical instance's own key (atomic CAS create). A DIFFERENT instance (a second manager in a
         // second workspace root) has a distinct id ⇒ a distinct key ⇒ it coexists; the create THROWS only
@@ -929,7 +973,7 @@ export class Manager {
         // crashed predecessor's not-yet-expired key), and we REFUSE loud. A crashed holder's key auto-expires
         // (bucket TTL). Losing the key LATER ends this process only when another process holds it; otherwise
         // the renew loop puts it back or keeps retrying ({@link renewLease}).
-        this.leaseInfo = { holder: this.ep.ref().id, instanceId: this.managerInstanceId, runtime: this.runtime.kind, root: resolve(this.workspaceRoot), pid: process.pid };
+        this.leaseInfo = { holder: this.ep.ref().id, instanceId: this.managerInstanceId, runtime: this.runtimeKind, root: resolve(this.workspaceRoot), pid: process.pid };
         try {
             this.leaseRevision = await this.ep.acquireManagerLease(this.leaseInfo);
         }
@@ -1073,7 +1117,7 @@ export class Manager {
         // refuses them until its reconcile has returned. A remote user-auth manager uses its four
         // registered issuer callbacks instead of holding a signer; a local user mesh stands none up.
         const remoteRuns = this.remoteAuthority?.runHosting;
-        if (this.remoteAuthority && remoteRuns) {
+        if (this.execution !== "none" && this.remoteAuthority && remoteRuns) {
             this.runHosting = new RunHosting({
                 space: this.space,
                 servers: this.servers,
@@ -1083,6 +1127,7 @@ export class Manager {
                 auth: undefined,
                 log: (line) => console.error(line),
                 admitRun: remoteRuns.admitRun,
+                revokeRun: remoteRuns.revokeRun,
                 issueAttempt: remoteRuns.issueAttempt,
                 issueOperator: remoteRuns.issueOperator,
                 renewRun: remoteRuns.renewRun,
@@ -1525,6 +1570,8 @@ export class Manager {
     async renewRemoteStandingBundle(force = false) {
         if (this.remoteBundleRenewal)
             return this.remoteBundleRenewal;
+        if (this.leaseStopping)
+            return;
         const renewal = this.renewRemoteStandingBundleOnce(force);
         this.remoteBundleRenewal = renewal;
         try {
@@ -2040,12 +2087,17 @@ export class Manager {
      *  touches NEITHER the lease NOR the endpoints — the caller owns those. */
     async teardownManagedAgents(managed = [...this.agents.values()]) {
         const failures = [];
+        const stopped = [];
         for (const a of managed) {
             // Free the slot + hard-stop each; `stopHandle` is best-effort (never throws — see it), so one bad
             // stop can't strand the rest, and every snapshot entry is deprovisioned below regardless.
             this.recordContinuityAtStop(a, "shutdown");
             this.agents.delete(a.name);
-            this.stopHandle(a, false);
+            const refused = this.stopHandle(a, false);
+            if (refused === undefined)
+                stopped.push(a);
+            else
+                failures.push(`${a.name}: stop failed: ${refused}`);
         }
         // The slot delete above bypasses freeSlot, which is where the reap line lives — so say it here,
         // once per seat, with the one stop cause that names this path: the shutdown itself. Without
@@ -2056,7 +2108,7 @@ export class Manager {
         // while any seat may still hold this instance's broker rails: that creates the exact orphan
         // window where a successor sees a dead manager but live predecessor authority. Every shipped
         // runtime now supplies waitForExit; absence or timeout is a failed shutdown, never a clean one.
-        await Promise.all(managed.map(async (a) => {
+        await Promise.all(stopped.map(async (a) => {
             try {
                 await this.awaitHandleExit(a.handle);
             }
@@ -2151,6 +2203,9 @@ export class Manager {
         // still move the key's revision after we clear the timer, and releasing against a cached
         // revision it has since moved is a CAS the broker correctly refuses, silently, forever.
         await this.leaseRenewTask?.catch(() => { });
+        // An already accepted host issuance must finish before standing transports close. The
+        // epoch/stop fence refuses adoption, but does not cancel the issuer's in-flight request.
+        await this.remoteBundleRenewal?.catch(() => { });
         // A spawn admitted before the fence closed may still be launching. Its seat must be in the
         // snapshot below, or it would outlive a stop that reported success.
         await this.awaitLifecycleDrain();
@@ -2267,13 +2322,7 @@ export class Manager {
             endpoint: MANAGER_ENDPOINT,
             instanceId: iid,
             registrationRevision,
-            observeGeneration: async () => {
-                const key = epgateKey(MANAGER_ENDPOINT, iid);
-                const entry = await authKv.get(key);
-                if (!entry || entry.operation !== "PUT")
-                    throw new Error(`no issuance gate at ${key}`);
-                return parseEndpointGate(entry.value, key).generation;
-            },
+            observeGeneration: () => readEndpointGateGeneration(authKv, { endpoint: MANAGER_ENDPOINT, instanceId: iid }),
         });
         try {
             const outcome = await ((this.auth || this.remoteAuthority)
@@ -2524,6 +2573,8 @@ export class Manager {
         {
             try {
                 const args = parseResumeControlArgs(rawArgs);
+                if (this.execution === "none" && args.inventory.agents.length !== 0)
+                    return { ok: false, error: this.executionRefusal() };
                 const inventoryDigest = createHash("sha256").update(JSON.stringify(args.inventory)).digest("hex");
                 if (!this.resumeAttemptId)
                     return { ok: false, error: "resumePreserved requires a manager started with --resume-attempt" };
@@ -2674,6 +2725,8 @@ export class Manager {
      *  surface comes up before the host): `unavailable`, retry. The three are told apart, since
      *  the first sentence steers a caller to `--local` and the others must not. */
     runHost() {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         if (this.runHosting)
             return this.runHosting;
         if (this.remoteAuthority && !this.remoteAuthority.runHosting)
@@ -2871,13 +2924,19 @@ export class Manager {
                 return { goalId, ...(result === undefined ? {} : { result }) };
             }),
             resolveCwd: (ctx) => this.serveGated(ctx, () => this.resolveSpawnCwd(args(ctx).cwd)),
+            resolveAgent: (ctx) => this.serveGated(ctx, async () => {
+                const persona = await this.spawnPersona(args(ctx), callerOf(ctx), ctx.subject.caller);
+                if ("error" in persona)
+                    throw new EpEnvelopeError(persona.error.startsWith("no persona") ? "not-found" : "failed-precondition", persona.error);
+                return { agent: persona.agent };
+            }),
             // P2 item 2: `spawn` is an ACTION - accept a goal + reply the acceptance floor payload, drive
             // progress + terminal off-handler (no ~30s block). The blocking reply path is gone (pin 8).
             // #373: arming the event plane (events: true, or the omission that arms it by default)
             // follows owner-domain reach on a user mesh. Resolve the caller's admin tier once for
             // the residual cross-owner case; opStart decides before connector resolution or grant
             // mutation. Static meshes resolve true and nothing changes.
-            spawn: (ctx) => this.serveGated(ctx, async () => this.serveSpawnGoal(ctx, async (h) => this.opStart(args(ctx), callerOf(ctx), await this.epAdminReach(ctx.subject.caller), h, ctx.subject.route))),
+            spawn: (ctx) => this.serveGated(ctx, async () => this.serveSpawnGoal(ctx, async (h) => this.opStart(args(ctx), callerOf(ctx), await this.epAdminReach(ctx.subject.caller), h, ctx.subject.route, ctx.subject.caller))),
             despawn: (ctx) => this.serveGated(ctx, async () => {
                 const a = targetAgent(ctx);
                 const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
@@ -3121,11 +3180,11 @@ export class Manager {
      *  grace window. POSIX delivers SIGTERM→SIGKILL natively, so it keeps the signal path. A hard stop
      *  (`graceful:false`, e.g. emergency reap) skips the cooperative step on every platform.
      *
-     *  BEST-EFFORT / never throws (#159 B2): a runtime hard-stop CAN throw (tmux `closeWindow` / cmux
-     *  `closeWorkspace` are direct calls), and every caller (despawn / self-stop / reap / shutdown) frees the
-     *  slot + deprovisions RIGHT AFTER — so a throwing stop must not abort that cleanup and leak the agent's
-     *  footprint, nor (in `reapChildrenOf`) abort the reap of later siblings. The failure is logged loudly,
-     *  never swallowed silently. Being the single stop chokepoint, guarding here covers all callers at once. */
+     *  Never throws (#159 B2): a runtime hard-stop CAN throw (tmux `closeWindow` / cmux `closeWorkspace`
+     *  are direct calls), and a throwing stop must not abort a caller's cleanup and leak the agent's
+     *  footprint, nor (in `reapChildrenOf`) abort the reap of later siblings. The failure is logged and
+     *  returned: a caller that must prove exit (shutdown, a failed resume) reports it as the cause at
+     *  once instead of waiting out a stop the runtime already refused. */
     stopHandle(a, graceful) {
         // The F5 TERMINALIZING latch (Unit B): flipped SYNCHRONOUSLY, before any await anywhere on
         // this stop path — later renewals refuse, while an already-admitted renewal drains before the
@@ -3143,7 +3202,9 @@ export class Manager {
                 a.handle.stop({ graceful });
         }
         catch (e) {
-            console.error(`stop ${a.name} (${a.id}): ${rejectionText(e)}`);
+            const failure = rejectionText(e);
+            console.error(`stop ${a.name} (${a.id}): ${failure}`);
+            return failure;
         }
     }
     /** Keep an accepted stop inside the lifecycle drain until the runtime proves the child is gone,
@@ -3487,7 +3548,7 @@ export class Manager {
             const info = a.handle.exitInfo?.();
             detail = info === undefined
                 ? `exit detail unavailable from runtime "${a.handle.kind}"`
-                : `exit code ${info.code ?? "unknown"}${info.signal === undefined ? "" : `, signal ${info.signal}`}${info.diagnostic ? `; last connector diagnostic: ${info.diagnostic}` : ""}`;
+                : `exit code ${info.code ?? "unknown"}${info.signal === undefined ? "" : `, signal ${info.signal}`}${info.diagnostic ? `; diagnostic: ${info.diagnostic}` : ""}`;
         }
         catch (e) {
             // A runtime that throws while being asked has told us something real; it must not take the
@@ -3561,6 +3622,10 @@ export class Manager {
         this.failSeatTurns(a.name, a.lifecycleUid);
         if (floor && Date.now() - a.startedAt < MIN_LIFETIME)
             this.cooling.push(a.startedAt + MIN_LIFETIME);
+        // The departed agent's own custody reference rides the teardown: the exit that freed this slot
+        // is usually the seat ending, but a stop that could not prove the process gone leaves one the
+        // terminal must still address before it frees the alias.
+        const target = { id: a.id, name: a.name, lifecycleUid: a.lifecycleUid, userOwner: a.userOwner, delegated: a.delegated, secretPaths: a.secretPaths, runtime: a.handle?.reference, ...(a.handedOff ? { delegatedHandle: a.handle } : {}), launch: { allowSubscribe: a.launch.allowSubscribe } };
         // #29 piece 3: on a USER mesh the name is RESERVED PENDING RETIREMENT — despawn started this
         // lifecycle's FULL teardown (footprint + standing-authority revoke + the auth-side retirement),
         // and the alias frees only when all of it completes (not the retirement alone). The detached
@@ -3572,24 +3637,22 @@ export class Manager {
         if (this.userMode) {
             const p = parsePrincipalKey(a.id);
             if (p)
-                this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: p.owner, actor: p.actor, agentId: a.id, userOwner: a.userOwner, delegated: a.delegated, secretPaths: a.secretPaths, launch: { allowSubscribe: a.launch.allowSubscribe }, ...(a.handedOff ? { delegatedHandle: a.handle } : {}), startedAt: Date.now() });
+                this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), owner: p.owner, actor: p.actor, target, startedAt: Date.now() });
         }
         else if (this.auth) {
             // Unit B: a STATIC lifecycle now also holds its name pending its own terminal (the F1
             // static retirement the detached deprovision below drives) — the alias frees only when the
             // gate+head terminal completes, exactly the user-mode discipline. The wire principal is the
             // incarnation-unique nkey (F5-bind); owner is the dev owner.
-            this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: DEV_OWNER, actor: a.id, agentId: a.id, secretPaths: a.secretPaths, launch: { allowSubscribe: a.launch.allowSubscribe }, runtime: a.handle?.reference, startedAt: Date.now() });
+            this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), owner: DEV_OWNER, actor: a.id, target, startedAt: Date.now() });
         }
         // Auth mode: tear down the departed agent's minted broker footprint + creds file (#159 B2). The
         // process is already gone, so this must never block the slot free or throw into the caller — it runs
         // detached, and a failure is logged loudly (never swallowed), not retried. The `agents` guard above
         // makes this fire exactly once per agent across every free path (despawn / self-stop / reap / exit).
-        // The departed agent's own custody reference rides the teardown: the exit that freed this slot
-        // is usually the seat ending, but a stop that could not prove the process gone leaves one the
-        // terminal must still address before it frees the alias.
+        // The agent's own fields ride along for its accepted renewal, which the static terminal drains first.
         if (!a.suppressCleanup && (this.maintenanceState === "active" || acceptedBeforeFence))
-            this.trackDeprovision({ ...a, runtime: a.handle?.reference, ...(a.handedOff ? { delegatedHandle: a.handle } : {}) });
+            this.trackDeprovision({ ...a, ...target });
     }
     /** Tear down a departed agent's minted footprint (#159 B2, auth mode): its local-principal durables
      *  (`dm_local-<id>`, `dlv_local-<id>`), its read-ACL row, and its creds file — everything the spawn's
@@ -3627,7 +3690,7 @@ export class Manager {
                 // The agent is its user's: only that user's retirement intent retires it, so the name stays
                 // held until retireDelegatedAgent confirms the host retired this UID.
                 const held = this.retiring.get(a.name);
-                if (held?.lifecycleUid === a.lifecycleUid)
+                if (held?.target.lifecycleUid === a.lifecycleUid)
                     held.lastError = `"${a.name}" was launched under a delegated user intent and retires only through its user's retirement intent`;
                 return;
             }
@@ -3697,7 +3760,7 @@ export class Manager {
             // legible operator copy. A retry re-drives this whole teardown (the same-name-spawn nudge routes
             // through deprovision, not the rail alone), so the revoke is re-attempted, not stranded.
             const holdRevoke = this.retiring.get(a.name);
-            if (holdRevoke && holdRevoke.lifecycleUid === a.lifecycleUid)
+            if (holdRevoke && holdRevoke.target.lifecycleUid === a.lifecycleUid)
                 holdRevoke.standingAuthorityLive = true;
             try {
                 await resolveAuthProvider().revokeAgent({
@@ -3706,12 +3769,12 @@ export class Manager {
                     actor: a.name,
                 });
                 const done = this.retiring.get(a.name);
-                if (done && done.lifecycleUid === a.lifecycleUid)
+                if (done && done.target.lifecycleUid === a.lifecycleUid)
                     done.standingAuthorityLive = false;
             }
             catch (e) {
                 const h = this.retiring.get(a.name);
-                if (h && h.lifecycleUid === a.lifecycleUid)
+                if (h && h.target.lifecycleUid === a.lifecycleUid)
                     h.lastError = `the agent's standing mint authority could not be revoked (${rejectionText(e)}); the name stays held so a copied actor token cannot mint fresh credentials. NEXT: a same-name spawn re-drives the full teardown (including the revoke), or recover the auth state.`;
                 console.error(`revoke agent grant ${a.name}: ${rejectionText(e)}`);
             }
@@ -3720,12 +3783,12 @@ export class Manager {
         try {
             const res = await this.deprovisionBroker(a);
             const h = this.retiring.get(a.name);
-            if (h && h.lifecycleUid === a.lifecycleUid)
+            if (h && h.target.lifecycleUid === a.lifecycleUid)
                 h.lastResources = res;
         }
         catch (e) {
             const h = this.retiring.get(a.name);
-            if (h && h.lifecycleUid === a.lifecycleUid) {
+            if (h && h.target.lifecycleUid === a.lifecycleUid) {
                 h.lastError = rejectionText(e);
                 if (e instanceof DeprovisionError)
                     h.lastResources = e.accounting;
@@ -3885,7 +3948,7 @@ export class Manager {
         // CAS the hold clear (audit #1 ABA): free the alias ONLY if the current hold is still THIS
         // lifecycle's. A late reply for a retired predecessor must never clear a successor's newer hold.
         const cur = this.retiring.get(a.name);
-        if (cur && cur.lifecycleUid === a.lifecycleUid) {
+        if (cur && cur.target.lifecycleUid === a.lifecycleUid) {
             if (cur.standingAuthorityLive) {
                 // INT-2: the auth-plane lifecycle retired, but the manager-side STANDING mint authority is
                 // not yet revoked. A copied token could still mint, so neither free the alias nor classify
@@ -4158,6 +4221,8 @@ export class Manager {
      *  comes from `restart.policy` when spawn carried `supervise`; otherwise the Pi session-recovery
      *  constants. Spending the budget falls through to normal retirement. */
     recoverManagedSession(a) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         const restart = a.restart;
         if (!restart || !restart.armed || restart.recovering || a.terminalizing)
             return;
@@ -4370,18 +4435,7 @@ export class Manager {
         return false;
     }
     /** Parse an untyped control-plane `start` request into {@link StartAgentOpts}. */
-    opStart(args, caller, admin, hooks, route = "inst") {
-        // `resume`, when present, must be a non-empty session id. An empty/whitespace value is a
-        // malformed request, not an implicit "spawn fresh" (no fallbacks). The CLI surfaces reject it,
-        // but a raw control message could otherwise slip an empty value through and silently start fresh.
-        if (args.resume !== undefined && !String(args.resume).trim())
-            return Promise.resolve({ ok: false, error: "resume: session id must not be empty" });
-        if (args.model !== undefined && !String(args.model).trim())
-            return Promise.resolve({ ok: false, error: "model: must not be empty" });
-        if (args.variant !== undefined && !String(args.variant).trim())
-            return Promise.resolve({ ok: false, error: "variant: must not be empty" });
-        if (args.defaultAgent !== undefined && !String(args.defaultAgent).trim())
-            return Promise.resolve({ ok: false, error: "defaultAgent: must not be empty" });
+    opStart(args, caller, admin, hooks, route = "inst", authenticatedCaller) {
         // Opaque launch options, when present, must be a mapping — a raw control message could send a
         // scalar/array (the CLI never does). Core doesn't interpret the keys; the connector validates them.
         if (args.launchOptions !== undefined && (typeof args.launchOptions !== "object" || args.launchOptions === null || Array.isArray(args.launchOptions)))
@@ -4454,28 +4508,28 @@ export class Manager {
         }
         return this.startAgent({
             name: String(args.name ?? "").trim(),
-            agent: args.agent ? String(args.agent) : undefined,
-            defaultAgent: args.defaultAgent ? String(args.defaultAgent) : undefined,
-            role: args.role ? String(args.role) : undefined,
-            config: args.config ? String(args.config) : undefined,
-            identity: args.identity ? String(args.identity) : undefined,
-            model: args.model ? String(args.model) : undefined,
-            variant: args.variant ? String(args.variant) : undefined,
+            agent: args.agent,
+            defaultAgent: args.defaultAgent,
+            role: args.role,
+            config: args.config,
+            identity: args.identity,
+            model: args.model,
+            variant: args.variant,
             launchOptions: args.launchOptions,
-            resume: args.resume ? String(args.resume) : undefined,
-            resumeClaim: args.resumeClaim !== undefined ? String(args.resumeClaim) : undefined,
-            resumeAgent: args.resumeAgent !== undefined ? String(args.resumeAgent) : undefined,
+            resume: args.resume,
+            resumeClaim: args.resumeClaim,
+            resumeAgent: args.resumeAgent,
             events,
             eventsNotice,
-            cwd: args.cwd ? String(args.cwd) : undefined,
-            prompt: args.prompt ? String(args.prompt) : undefined,
+            cwd: args.cwd,
+            prompt: args.prompt,
             subscribe,
             allowSubscribe,
             allowPublish,
             shareTools,
             ...(supervise !== undefined ? { supervise } : {}),
             route,
-        }, caller, hooks);
+        }, caller, hooks, authenticatedCaller);
     }
     /** The realpath + directory checks a placed spawn directory must pass on this manager's host,
      * shared by the served `resolve-cwd` command and the `spawn` admission check (#385 item 2): one
@@ -4534,6 +4588,10 @@ export class Manager {
      * reports ready. A missing harness degrades only that connector, never unrelated lifecycle work:
      * boot continues, but prints a named refusal and records it on both manager status surfaces. */
     async inspectConnectorsAtBoot() {
+        if (this.execution === "none") {
+            this.connectorStatuses = [];
+            return;
+        }
         const rows = [];
         let declared;
         if (this.installedExtensions) {
@@ -4569,6 +4627,8 @@ export class Manager {
      *  inventory load) skips the class `one` subscribe for spawn/launch so this member cannot
      *  consume an unpinned request a sibling could serve. */
     classSpawnEnabled() {
+        if (this.execution === "none")
+            return false;
         return this.connectorStatuses.some((row) => row.state === "available");
     }
     omitClassCommands() {
@@ -4692,6 +4752,8 @@ export class Manager {
      *  `runId`, and resolved `hash`. USER mesh: a privileged-tier launch is owner-equality-authorized
      *  (spec owner === caller owner) before any side effect; the admin tier keeps operator behavior. */
     async opLaunch(args, caller, admin, hooks, route = "inst") {
+        if (this.execution === "none")
+            return { ok: false, error: this.executionRefusal() };
         const runId = String(args.runId ?? "").trim();
         const name = String(args.name ?? "").trim();
         if (!runId || !name)
@@ -4756,30 +4818,23 @@ export class Manager {
      *  `spawner` is the authenticated id of the peer that requested the spawn (`req.from.id`),
      *  defaulting to the manager's own id for roster/pre-spawn — recorded for the spawner
      *  ledger (own-children despawn + reap-on-parent-exit). */
-    async startAgent(opts, spawner, hooks) {
+    async startAgent(opts, spawner, hooks, authenticatedCaller) {
+        if (this.execution === "none")
+            return { ok: false, error: this.executionRefusal() };
         const release = this.beginLifecycle();
         if (!release)
             return { ok: false, error: this.maintenanceError() };
         try {
-            return await this.startAgentActive(opts, spawner, hooks);
+            return await this.startAgentActive(opts, spawner, hooks, authenticatedCaller);
         }
         finally {
             release();
         }
     }
-    async startAgentActive(opts, spawner, hooks) {
-        // Before the first await, so the grant, the launch and the retained form all read the lists as admitted.
-        opts = ownLists(opts);
-        if (opts.resolved)
-            opts.resolved = ownLists(opts.resolved);
-        if (opts.delegatedIntent) {
-            if (!this.remoteAuthority?.executeDelegatedUserIntent)
-                return { ok: false, error: `"${opts.name}" names a delegated user intent, and this manager has no host execution for one` };
-            if (opts.supervise)
-                return { ok: false, error: `"${opts.name}" names a delegated user intent, and a delegated agent is never restarted (SPEC 13.16)` };
-            // A delegated launch's spawner is the user's principal, never the composition root's call.
-            spawner = opts.delegatedIntent.parent;
-        }
+    /** The persona file a spawn loads and the harness it resolves, shared by `spawn` and the served
+     *  `resolve-agent` read: a detached resume locates the session it carries with the connector this
+     *  names, so the two doors must not drift (#2899). */
+    async spawnPersona(opts, spawner, authenticatedCaller) {
         // The spawn argument is a persona REF — a filename in `.cotal/agents` (the unique spawn KEY), or
         // a path via `--config`. It is NOT the mesh identity: the identity comes from inside the file
         // (`name:`), so a persona can be filed descriptively (review-critic.md) yet present under a
@@ -4787,48 +4842,79 @@ export class Manager {
         // filename (unique on disk); two files can't collide on the key.
         const ref = opts.name.trim();
         if (!ref)
-            return { ok: false, error: "name required" };
+            return { error: "name required" };
         // A bare ref maps to `.cotal/agents/<ref>.md`, so it must be a safe token (no path traversal); a
         // `--config` path is validated by existsSync below instead.
         if (!opts.config) {
             const refErr = this.nameError(ref);
             if (refErr)
-                return { ok: false, error: refErr };
+                return { error: refErr };
         }
         // Resolve the persona file (fail loud — NO silent default-ACL fallback). A missing persona used
         // to mint DEFAULT creds (read `general` only, default-deny publish, no capabilities), so a
         // typo'd / renamed / spawned-by-display-name agent became live with silently-wrong ACLs — a
         // behavioral/security bug. Fail loud instead, matching `cotal spawn` (loadAgentFile throws).
-        // This runs BEFORE the connector resolution below: the file's `agent:` pin participates in the
-        // harness choice (flag > file > COTAL_DEFAULT_AGENT > default, #869), which is impossible if the
-        // connector is materialized first. Still synchronous (existsSync/readFileSync), so the capacity/
-        // reserve span below stays atomic.
+        // This runs BEFORE the spawn path resolves its connector: the file's `agent:` pin participates in
+        // the harness choice (flag > file > COTAL_DEFAULT_AGENT > default, #869), which is impossible if
+        // the connector is materialized first.
         let configPath;
         if (opts.config) {
             configPath = agentFilePath(this.workspaceRoot, opts.config);
             if (!existsSync(configPath))
-                return { ok: false, error: `agent file not found: ${configPath}` };
+                return { error: `agent file not found: ${configPath}` };
         }
         else {
             configPath = agentFilePath(this.workspaceRoot, ref);
             if (!existsSync(configPath))
-                return { ok: false, error: `no persona "${ref}" - ${configPath} not found; create it or pass --config (see \`cotal personas list\`)` };
+                return { error: `no persona "${ref}" - ${configPath} not found; create it or pass --config (see \`cotal personas list\`)` };
         }
         // Load the persona ONCE, here, ahead of the connector choice. The file's `agent:` pin feeds the
-        // harness resolution below; the identity/ACL profile block later consumes the SAME def (no second
-        // load). A manifest launch (`resolved`) materializes its own transient persona and the file is
-        // NOT its authority, so its def (and its agent pin) is deliberately not consulted here — the
-        // manifest's own `agent:` field drove the launch object already.
+        // harness resolution below; the spawn path's identity/ACL profile block consumes the SAME def (no
+        // second load). A manifest launch (`resolved`) materializes its own transient persona and the
+        // file is NOT its authority, so its def (and its agent pin) is deliberately not consulted here —
+        // the manifest's own `agent:` field drove the launch object already.
         let def;
         if (!opts.resolved) {
             try {
                 def = loadAgentFile(configPath);
             }
             catch (e) {
-                return { ok: false, error: rejectionText(e) };
+                return { error: rejectionText(e) };
+            }
+            // Shared operator files remain launchable. Owned content follows the catalog's visibility
+            // decision before connector loading or any allocation. A hosted run acts for its admission;
+            // only a complete authenticated caller can request the current ledger's admin decision.
+            if (this.userMode && def.owner !== undefined) {
+                const acting = authenticatedCaller === undefined ? undefined
+                    : this.runHosting?.admittedCaller(authenticatedCaller) ?? authenticatedCaller;
+                const personaCaller = acting === undefined ? spawner ?? "" : principalKey(acting.owner, acting.actor).key;
+                const admin = authenticatedCaller !== undefined && await this.epAdminReach(authenticatedCaller);
+                if (!this.canReadPersona(def.owner, personaCaller, admin))
+                    return { error: `no persona "${ref}"` };
             }
         }
-        const agent = resolveAgentType({ flag: opts.agent, pin: def?.agent, callerDefault: opts.defaultAgent });
+        return { ref, configPath, def, agent: resolveAgentType({ flag: opts.agent, pin: def?.agent, callerDefault: opts.defaultAgent }) };
+    }
+    async startAgentActive(opts, spawner, hooks, authenticatedCaller) {
+        // Before the first await, so the grant, the launch, the retained form and the restart slot all read
+        // the lists and the restart policy as admitted.
+        opts = ownLists(opts);
+        if (opts.resolved)
+            opts.resolved = ownLists(opts.resolved);
+        if (opts.supervise)
+            opts.supervise = { restarts: opts.supervise.restarts, windowMs: opts.supervise.windowMs };
+        if (opts.delegatedIntent) {
+            if (!this.remoteAuthority?.executeDelegatedUserIntent)
+                return { ok: false, error: `"${opts.name}" names a delegated user intent, and this manager has no host execution for one` };
+            if (opts.supervise)
+                return { ok: false, error: `"${opts.name}" names a delegated user intent, and a delegated agent is never restarted (SPEC 13.16)` };
+            // A delegated launch's spawner is the user's principal, never the composition root's call.
+            spawner = opts.delegatedIntent.parent;
+        }
+        const persona = await this.spawnPersona(opts, spawner, authenticatedCaller);
+        if ("error" in persona)
+            return { ok: false, error: persona.error };
+        const { ref, configPath, def, agent } = persona;
         // Materialize the requested connector up front — the ONE async step in the spawn path (a lazy
         // `cotal ext` manifest import on the published binary). It runs BEFORE the capacity/reserve span
         // below so that span stays fully SYNCHRONOUS and atomic. On the manifest binary this also honors a
@@ -4886,15 +4972,15 @@ export class Manager {
         // exit, so a name cannot be respawned in place. User-mode seats have no static slot that
         // keeps the incarnation owned across a process death, so the same refusal applies there.
         if (opts.supervise !== undefined) {
-            if (this.runtime.kind !== "pty")
-                return { ok: false, error: `supervise is a restart policy this host cannot enforce: runtime "${this.runtime.kind}" cannot respawn a name in place` };
+            if (this.requiredRuntime.kind !== "pty")
+                return { ok: false, error: `supervise is a restart policy this host cannot enforce: runtime "${this.requiredRuntime.kind}" cannot respawn a name in place` };
             if (this.userMode)
                 return { ok: false, error: "supervise is a restart policy this host cannot enforce: a user-mode seat has no static slot to keep the incarnation owned across a process death" };
         }
         // A delegated seat starts outside this host from values alone, so a choice only this host can
         // honour is refused here, before enrollment, and named rather than dropped.
-        if (this.runtime.spawnDelegated) {
-            const delegatedBy = `runtime "${this.runtime.kind}" starts seats outside this host`;
+        if (this.requiredRuntime.spawnDelegated) {
+            const delegatedBy = `runtime "${this.requiredRuntime.kind}" starts seats outside this host`;
             if (!this.remoteAuthority?.enrollManagedAgent)
                 return { ok: false, error: `${delegatedBy}, which needs a host that enrolls managed agents (remoteAuthority.enrollManagedAgent); a delegated seat has no local grant path` };
             try {
@@ -5055,7 +5141,7 @@ export class Manager {
             return { ok: false, error: `the name "${identityName}" is still reconciling at manager startup; its prior lifecycle terminal owns this alias until it completes. Retry shortly.` };
         const held = this.retiring.get(identityName);
         if (held !== undefined) {
-            void this.deprovision({ id: held.agentId, name: identityName, lifecycleUid: held.lifecycleUid, userOwner: held.userOwner, delegated: held.delegated, secretPaths: held.secretPaths, delegatedHandle: held.delegatedHandle, launch: held.launch }).catch(() => { });
+            void this.deprovision(held.target).catch(() => { });
             const err = lifecycleBlocked("failed-precondition", `the name "${identityName}" is reserved pending retirement: its previous agent's despawn started that lifecycle's teardown (footprint + standing-authority revoke + auth-side retirement), and the name frees only when all of it completes${held.lastError !== undefined ? ` (last attempt: ${held.lastError})` : ""}. NEXT: wait a moment and retry this spawn (retrying re-drives the whole teardown), or pick another name.`, { blockedOp: "retirement", opId: held.opId, remedy: "retry" });
             return { ok: false, error: renderLifecycleBlocked(err.message, err), details: err.details };
         }
@@ -5076,9 +5162,9 @@ export class Manager {
             }
         }
         // The child takes launch options as `--opt k=v`, so only string values can cross to it.
-        const unportable = this.runtime.spawnDelegated ? Object.keys(launchOptions ?? {}).filter((k) => typeof launchOptions[k] !== "string") : [];
+        const unportable = this.requiredRuntime.spawnDelegated ? Object.keys(launchOptions ?? {}).filter((k) => typeof launchOptions[k] !== "string") : [];
         if (unportable.length)
-            return { ok: false, error: `runtime "${this.runtime.kind}" starts seats outside this host, so it cannot pass non-string launch options (${unportable.join(", ")})` };
+            return { ok: false, error: `runtime "${this.requiredRuntime.kind}" starts seats outside this host, so it cannot pass non-string launch options (${unportable.join(", ")})` };
         // The AG-UI event plane is on unless the launch explicitly opted out. Refused HERE, before
         // anything is minted: a connector that cannot
         // emit must fail before provisioning rather than after, exactly as an unsupported `resume` does.
@@ -5115,7 +5201,7 @@ export class Manager {
         // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `_2`
         // suffix (so an address-by-triple caller's pinned name can't be re-pointed). A PERSONA-DERIVED
         // base name (no pin) keeps uniqueName's collision numbering, so multi-peer `spawn reviewer` twice
-        // still yields reviewer + reviewer_2. The retiring-hold refuse (~2472) is orthogonal and already fired.
+        // still yields reviewer + reviewer_2. The alias-reuse gate above is orthogonal and already fired.
         const hardPinned = opts.identity !== undefined || opts.resolved !== undefined;
         let name;
         if (hardPinned) {
@@ -5399,12 +5485,12 @@ export class Manager {
             // manager path is produced for it, only the handoff its runtime writes into the child.
             let spec;
             let handle;
-            if (this.runtime.spawnDelegated) {
+            if (this.requiredRuntime.spawnDelegated) {
                 const handoff = this.composeManagedHandoff(enrolled.material, enrolled.actorToken);
                 if (this.delegatedLaunched.has(lifecycleUid))
-                    throw new Error(`lifecycle ${lifecycleUid} was already handed to runtime "${this.runtime.kind}"; a lifecycle is handed off at most once`);
+                    throw new Error(`lifecycle ${lifecycleUid} was already handed to runtime "${this.requiredRuntime.kind}"; a lifecycle is handed off at most once`);
                 this.delegatedLaunched.add(lifecycleUid);
-                handle = this.runtime.spawnDelegated({ agent, persona: readFileSync(configPath, "utf8"), role, model, variant, prompt, launchOptions: launchOptions, events }, handoff);
+                handle = this.requiredRuntime.spawnDelegated({ agent, persona: readFileSync(configPath, "utf8"), role, model, variant, prompt, launchOptions: launchOptions, events }, handoff);
             }
             else {
                 if (carried) {
@@ -5619,7 +5705,7 @@ export class Manager {
                 // retires it, and its name stays held for retireDelegatedAgent.
                 const p = orphan.delegated ? parsePrincipalKey(orphan.id) : null;
                 if (p)
-                    this.retiring.set(orphan.name, { opId: retireOpId(orphan.lifecycleUid), lifecycleUid: orphan.lifecycleUid, owner: p.owner, actor: p.actor, agentId: orphan.id, userOwner: orphan.userOwner, delegated: true, secretPaths: orphan.secretPaths, startedAt: Date.now() });
+                    this.retiring.set(orphan.name, { opId: retireOpId(orphan.lifecycleUid), owner: p.owner, actor: p.actor, target: orphan, startedAt: Date.now() });
                 this.trackDeprovision(orphan, "(orphaned spawn)");
             }
         }
@@ -5628,6 +5714,8 @@ export class Manager {
      * principal without provisioning. A later runtime launch failure is reported per-agent, but malformed
      * or missing inventory material can never produce a partially resumed set. */
     async resumePreserved(inventory) {
+        if (this.execution === "none" && (!Array.isArray(inventory.agents) || inventory.agents.length !== 0))
+            return { ok: false, agents: [], error: this.executionRefusal() };
         const release = this.beginLifecycle(true);
         if (!release)
             return { ok: false, agents: [], error: this.maintenanceError() };
@@ -5660,19 +5748,11 @@ export class Manager {
                 // already removed the hold, so fresh-lifecycle resume still reaches the fail-closed roster gate.
                 const held = this.retiring.get(entry.name);
                 if (held) {
-                    void this.deprovision({
-                        id: held.agentId,
-                        name: entry.name,
-                        lifecycleUid: held.lifecycleUid,
-                        userOwner: held.userOwner,
-                        delegated: held.delegated,
-                        secretPaths: held.secretPaths,
-                        delegatedHandle: held.delegatedHandle,
-                    }).catch(() => { });
+                    void this.deprovision(held.target).catch(() => { });
                     return {
                         ok: false,
                         agents: [],
-                        error: `retained agent "${entry.name}" is reserved pending retirement: its previous lifecycle ${held.lifecycleUid} still owns the alias${held.lastError ? ` (last attempt: ${held.lastError})` : ""}; retrying re-drives that exact teardown`,
+                        error: `retained agent "${entry.name}" is reserved pending retirement: its previous lifecycle ${held.target.lifecycleUid} still owns the alias${held.lastError ? ` (last attempt: ${held.lastError})` : ""}; retrying re-drives that exact teardown`,
                     };
                 }
                 let principal;
@@ -5938,7 +6018,7 @@ export class Manager {
     async orphanedResumeSeat(entry, principal, liveRoster) {
         if (!this.auth || this.userMode || entry.identity.mode !== "static")
             return undefined;
-        if (typeof this.runtime.reap !== "function")
+        if (typeof this.requiredRuntime.reap !== "function")
             return undefined;
         if (liveRoster.some((p) => p.card.id === principal && p.lifecycleUid !== entry.identity.lifecycleUid))
             return undefined;
@@ -5947,14 +6027,14 @@ export class Manager {
             return undefined;
         if (ownedBySibling(slot, this.managerInstanceId))
             return undefined;
-        return slot.runtime?.kind === this.runtime.kind ? slot.runtime : undefined;
+        return slot.runtime?.kind === this.requiredRuntime.kind ? slot.runtime : undefined;
     }
     /** Reap a seat {@link orphanedResumeSeat} found, then wait for its principal to leave presence so
      *  the relaunch's readiness cannot match the dead seat's row. Returns the refusal when the reap
      *  proves nothing or the principal stays live, which means another process holds it. */
     async reapOrphanedResumeSeat(principal, reference) {
         try {
-            const evidence = await requireRuntimeReap(this.runtime, reference);
+            const evidence = await requireRuntimeReap(this.requiredRuntime, reference);
             console.error(`resume: reaped orphaned seat ${reference.kind}:${reference.id} of retained principal "${principal}" (${evidence.detail})`);
         }
         catch (e) {
@@ -5971,14 +6051,16 @@ export class Manager {
     /** Validate/relaunch one retained inventory entry. Called only through resumePreserved so all
      * records pass the same preflight before the first child is exposed. */
     async resumePreservedAgent(entry, preflightOnly = false, batchReserved = false, prepared) {
+        if (this.execution === "none")
+            return { ok: false, error: this.executionRefusal() };
         const release = this.beginLifecycle(batchReserved);
         if (!release)
             return { ok: false, error: this.maintenanceError() };
         try {
             if (entry.space !== this.space)
                 return { ok: false, error: `retained agent ${entry.name} belongs to space "${entry.space}", not "${this.space}"` };
-            if (entry.launch.runtime !== this.runtime.kind)
-                return { ok: false, error: `retained agent ${entry.name} requires runtime "${entry.launch.runtime}", current manager uses "${this.runtime.kind}"` };
+            if (entry.launch.runtime !== this.requiredRuntime.kind)
+                return { ok: false, error: `retained agent ${entry.name} requires runtime "${entry.launch.runtime}", current manager uses "${this.requiredRuntime.kind}"` };
             const nameErr = this.nameError(entry.name);
             if (nameErr)
                 return { ok: false, error: nameErr };
@@ -6259,13 +6341,13 @@ export class Manager {
      *  would reap it: it is freed only once its exit is proved, and otherwise stays managed until it
      *  exits or the manager stops it. */
     async stopFailedResume(managed, cause, detail) {
-        this.stopHandle(managed, false);
-        try {
-            await this.awaitHandleExit(managed.handle);
-        }
-        catch (exit) {
+        const refused = this.stopHandle(managed, false);
+        const unproven = refused === undefined
+            ? await this.awaitHandleExit(managed.handle).then(() => undefined, rejectionText)
+            : `stop failed: ${refused}`;
+        if (unproven !== undefined) {
             this.watchExit(managed);
-            return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${rejectionText(exit)}` };
+            return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${unproven}` };
         }
         this.freeSlot(managed, true, cause, true);
         return { ok: false, error: detail };
@@ -6366,28 +6448,9 @@ export class Manager {
                 if (done || !s)
                     return;
                 clearTimeout(timer);
-                // ┌─ DO NOT MOVE THIS READ. Its POSITION is the fix; its value is not. ──────────────────┐
-                // MOVING IT BELOW `onAgentExit` MAKES READINESS STOP REPORTING GENUINE LAUNCH FAILURES.
-                // That is what breaks — not a style regression, a silent loss of every `failed` terminal
-                // for an agent that really did die on launch. `onAgentExit` reaches `freeSlot`, which sets
-                // this SAME latch on its way through (see its "also covers exit/reap paths" comment), so a
-                // read taken after that call is true for EVERY exit, deliberate or not.
-                //
-                // Read HERE — first statement, before the await and before `onAgentExit` — a set latch can
-                // only have been set by someone else, and the only other setter on this path is
-                // `stopHandle`, which latches SYNCHRONOUSLY and then kills with no suspension between. So a
-                // despawn-caused exit is guaranteed observed with the latch UP and a natural exit with it
-                // DOWN: the distinction holds by program order, never by winning a race.
-                //
-                // The same latch, read one function call apart, answers two different questions.
-                //
-                // TO RE-VERIFY (this is the mutation that proves it, and it is the exact regression a tidy
-                // refactor produces): move this capture below `onAgentExit` and run
-                // `pnpm smoke:manager-spawn-action`. M3 `process exit -> failed` must FAIL. Note that M4 —
-                // the case this fix exists for — still PASSES under that mutation, so the suite this fix
-                // was written against cannot catch its own regression. M3 catches it only because it
-                // happens to share a file.
-                // └──────────────────────────────────────────────────────────────────────────────────────┘
+                // `stopHandle` sets `terminalizing` synchronously before it kills, and `onAgentExit` sets it
+                // through `freeSlot` when it retires the seat, so only a read before the await and the reap
+                // tells a deliberate stop from a launch failure.
                 const deliberate = a.terminalizing === true;
                 void (async () => {
                     // waitForExit may close the attach stream before this snapshot
@@ -6412,7 +6475,23 @@ export class Manager {
                         finish({ ok: false, deliberate: true, detail: `${a.name} was stopped before it reported ready` });
                         return;
                     }
-                    finish({ ok: false, detail: `${a.name} exited on launch${tail ? ` - last output: ${tail}` : ""}` });
+                    // The screen's last row can be a dialog footer, so the exit's diagnostic is named beside it:
+                    // it carries the runtime's own reason when it stopped the seat. A connector that ends on its
+                    // diagnostic already shows it as the last row, and it is not repeated.
+                    let exitDetail = "";
+                    try {
+                        const diagnostic = a.handle.exitInfo?.()?.diagnostic;
+                        if (diagnostic && diagnostic !== tail)
+                            exitDetail = `; diagnostic: ${diagnostic}`;
+                    }
+                    catch (e) {
+                        // The backstop is already cleared, so a reader that throws must still let this settle.
+                        exitDetail = `; exit detail unreadable from runtime "${a.handle.kind}": ${rejectionText(e)}`;
+                    }
+                    // A runtime's text can carry a lone surrogate, which is not I-JSON, and the failed terminal
+                    // this detail becomes is refused with it.
+                    exitDetail = exitDetail.replace(/\p{Cs}/gu, "\uFFFD");
+                    finish({ ok: false, detail: `${a.name} exited on launch${tail ? ` - last output: ${tail}` : ""}${exitDetail}` });
                 })();
             };
             timer = setTimeout(() => finish({
@@ -6459,25 +6538,15 @@ export class Manager {
         return chars.length > 160 ? `…${chars.slice(-160).join("")}` : text;
     }
     /** Subscribe to a managed agent's process-exit so a self-driven exit frees its slot and reaps
-     *  its children (P4b/P4c). Only pty streams exit (via the attach session's `onExit`); external runtimes'
-     *  attach() throws, so this is a no-op there — a self-EXITED agent under those runtimes is reaped
-     *  by nothing until it's explicitly despawned (graceful-stop runs on despawn, not self-exit). The
-     *  cap still holds (a lingering corpse counts toward it); runtime-agnostic exit-reaping (a real
-     *  per-runtime `status()` → exited-sweep at the availability gate) is a tracked follow-up. */
+     *  its children (P4b/P4c). The watch is bound to the current handle: a restart swaps in a new one
+     *  and watches it, so a late exit proved for the old handle must not retire the row. */
     watchExit(a) {
-        try {
-            const session = a.handle.attach();
-            session.onExit(() => this.onAgentExit(a));
-            // Close the TOCTOU between the early-exit probe's unsubscribe and this subscribe: if the child
-            // exited in that gap, the `onExit` above never fires (a late subscriber can't hear a past event),
-            // so the agent would leak (never reaped, never deprovisioned). Re-check status right after
-            // subscribing and reap it now if it already went. onAgentExit is idempotent (freeSlot's guard).
-            if (a.handle.status() === "exited")
-                this.onAgentExit(a);
-        }
-        catch {
-            /* runtime doesn't stream an exit signal — nothing to wire */
-        }
+        const handle = a.handle;
+        const current = () => this.agents.get(a.name) === a && a.handle === handle;
+        const watched = watchProvedExit(handle, () => { if (current())
+            this.onAgentExit(a); }, current);
+        if (!watched)
+            console.error(`! ${a.name}: runtime "${handle.kind}" cannot prove a child exit (AgentHandle.waitForExit is not implemented) - it stays managed after it exits, until it is stopped`);
     }
     /** Prune expired cooling stamps (drop those at/before now) and return the live count — the
      *  recycle floor's contribution to the ceiling (P4c). Lazy: pruned only when the gate consults it. */
@@ -6571,8 +6640,8 @@ export class Manager {
         try {
             const live = this.agents.get(name);
             const held = live ? undefined : this.retiring.get(name);
-            const principal = live?.delegated ? parsePrincipalKey(live.id) : held?.delegated ? held : null;
-            const lifecycleUid = live?.lifecycleUid ?? held?.lifecycleUid;
+            const principal = live?.delegated ? parsePrincipalKey(live.id) : held?.target.delegated ? held : null;
+            const lifecycleUid = live?.lifecycleUid ?? held?.target.lifecycleUid;
             if (!principal || !lifecycleUid)
                 return { ok: false, error: `no agent named "${name}" was launched on this manager under a delegated user intent` };
             const target = { owner: principal.owner, actor: principal.actor, lifecycleUid };
@@ -6587,7 +6656,7 @@ export class Manager {
             catch (e) {
                 const error = `the delegated retirement under intent ${intentId} did not complete (${rejectionText(e)})`;
                 const hold = this.retiring.get(name);
-                if (hold?.lifecycleUid === target.lifecycleUid)
+                if (hold?.target.lifecycleUid === target.lifecycleUid)
                     hold.lastError = error;
                 return { ok: false, error: `${error}; "${name}" is unchanged` };
             }
@@ -6733,8 +6802,11 @@ export class Manager {
     managerStatusData() {
         return {
             instanceId: this.managerInstanceId,
-            runtime: this.runtime.kind,
-            custody: this.runtime.kind === "pty" && this.runtime.supportsRelease === true ? "custodied" : "legacy",
+            execution: this.execution,
+            runtime: this.runtimeKind,
+            custody: this.execution === "none" ? "none" : this.requiredRuntime.kind === "pty" && this.requiredRuntime.supportsRelease === true ? "custodied" : "legacy",
+            runHosting: this.execution !== "none" && (this.remoteAuthority ? this.remoteAuthority.runHosting !== undefined : !this.userMode && this.auth !== undefined),
+            terminalSessions: this.execution !== "none",
             agentCount: this.agents.size,
             uptimeMs: Date.now() - this.startedAtMs,
             connectors: this.connectorStatuses.map((row) => ({ ...row, binaries: { ...row.binaries } })),
@@ -7742,6 +7814,8 @@ export class Manager {
      *  Returns the acceptance floor payload {name, owner, actor, uid, goalId, fingerprint, executor}
      *  (the ALLOCATED identity). goalId = the request id (env.id, Q3). */
     async serveSpawnGoal(ctx, run) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         const gw = this.goalWriter;
         if (!gw)
             throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing; spawn-as-action cannot accept (SPEC 13.6)");
@@ -8008,9 +8082,11 @@ export class Manager {
         }
         const raw = (ctx.request.args ?? {});
         const payload = String(raw.payload);
-        const deadlineMs = Number(raw.deadlineMs);
+        const deadlineAt = raw.deadlineAt === undefined ? acceptedAt + Number(raw.deadlineMs) : Number(raw.deadlineAt);
+        if (deadlineAt <= acceptedAt)
+            throw new EpEnvelopeError("deadline-exceeded", `goal "${goalId}" names a deadline already past (${new Date(deadlineAt).toISOString()}); a turn with no time left to serve it is never accepted (SPEC 13.6)`);
+        const deadlineMs = deadlineAt - acceptedAt;
         const handoffFrom = raw.handoffFrom === undefined ? undefined : String(raw.handoffFrom);
-        const deadlineAt = acceptedAt + deadlineMs;
         const note = JSON.stringify({ payload, deadlineAt, holdEpoch: executor.epoch, owner: t.owner, ...(handoffFrom !== undefined ? { handoffFrom } : {}) });
         // A goal that already ENDED is never accepted again, whatever the retry carries: the bind is
         // create-only and outlives an unwind (the failed terminal, the cleared index), so a retry of an
@@ -8531,13 +8607,13 @@ export class Manager {
      *  exist. Absent for a runtime with no durable custody (there is nothing a successor could reap
      *  by reference), which is the only case that still spawns unreserved. */
     reserveCustody() {
-        return isCustodialRuntime(this.runtime) ? this.runtime.reserve() : undefined;
+        return isCustodialRuntime(this.requiredRuntime) ? this.requiredRuntime.reserve() : undefined;
     }
     /** Spawn under a reserved reference and prove the runtime honoured it. A runtime that minted its
      *  own id instead would leave every durable record addressing a seat that does not exist, so the
      *  mismatch tears the new seat down and throws rather than returning an unaddressable handle. */
     async spawnCustodied(name, spec, cwd, reserved) {
-        const handle = this.runtime.spawn(name, spec, cwd, reserved);
+        const handle = this.requiredRuntime.spawn(name, spec, cwd, reserved);
         if (reserved === undefined)
             return handle;
         const got = handle.reference;
@@ -8559,7 +8635,7 @@ export class Manager {
         }
         else {
             try {
-                const evidence = await requireRuntimeReap(this.runtime, got);
+                const evidence = await requireRuntimeReap(this.requiredRuntime, got);
                 disposal = `the spawned seat was reaped (${evidence.detail})`;
             }
             catch (e) {
@@ -8573,7 +8649,7 @@ export class Manager {
                         : `the spawned seat could NOT be reaped: ${rejectionText(e)}`;
             }
         }
-        throw new Error(`runtime "${this.runtime.kind}" reserved custody ${reserved.kind}:${reserved.id} for "${name}" but spawned ` +
+        throw new Error(`runtime "${this.requiredRuntime.kind}" reserved custody ${reserved.kind}:${reserved.id} for "${name}" but spawned ` +
             `${got ? `${got.kind}:${got.id}` : "a handle with no reference"}; the recorded reference would address no seat, so ${disposal}`);
     }
     /** The terminal's process step: an orphan (no live handle in THIS process) is reaped by the custody
@@ -8588,14 +8664,14 @@ export class Manager {
             // before the reservation existed, or a caller that dropped the reference on the way here.
             // Do not name the slot row: the row may well hold a reference this caller never read, and
             // a diagnostic that guesses which is which sends the reader the wrong way.
-            if (isCustodialRuntime(this.runtime))
-                console.error(`static retirement ${a.name}: no custody reference reached this terminal, though runtime "${this.runtime.kind}" custodies its seats; any seat it launched is not addressable from here`);
+            if (isCustodialRuntime(this.requiredRuntime))
+                console.error(`static retirement ${a.name}: no custody reference reached this terminal, though runtime "${this.requiredRuntime.kind}" custodies its seats; any seat it launched is not addressable from here`);
             return;
         }
         // An unproven reap throws from here rather than printing, so it propagates into
         // driveStaticRetirement's catch, which records the failure and HOLDS the name. That is the whole
         // point of refusing: the alias must not be freed while a seat nobody proved gone may still run.
-        const evidence = await requireRuntimeReap(this.runtime, a.runtime);
+        const evidence = await requireRuntimeReap(this.requiredRuntime, a.runtime);
         console.error(`static retirement ${a.name}: orphan seat process ${evidence.detail}`);
     }
     /** The static F1 terminal for one departed incarnation (Unit B): delegates the gate/head CAS
@@ -8663,14 +8739,14 @@ export class Manager {
             const principal = principalKey(DEV_OWNER, a.id).key;
             this.retiredPrincipals.add(principal);
             const cur = this.retiring.get(a.name);
-            if (cur && cur.lifecycleUid === a.lifecycleUid) {
+            if (cur && cur.target.lifecycleUid === a.lifecycleUid) {
                 this.retiring.delete(a.name); // ABA-guarded hold clear
                 this.confirmedRetiredPredecessors.set(a.name, { principal, lifecycleUid: a.lifecycleUid });
             }
         }
         catch (e) {
             const h = this.retiring.get(a.name);
-            if (h && h.lifecycleUid === a.lifecycleUid)
+            if (h && h.target.lifecycleUid === a.lifecycleUid)
                 h.lastError = `the static retirement did not complete (${rejectionText(e)}); the name stays held - a same-name spawn retries the same terminal (op ${opId})`;
             console.error(`static retirement ${a.name} (${a.id}): ${rejectionText(e)}`);
             if (surfaceFailure)
@@ -9173,9 +9249,9 @@ export class Manager {
                     : undefined;
         }
         for (const [name, hold] of this.retiring) {
-            const held = hold.userOwner ? hold.agentId : principalKey(DEV_OWNER, hold.agentId).key;
+            const held = hold.target.userOwner ? hold.target.id : principalKey(DEV_OWNER, hold.target.id).key;
             if (held === caller)
-                return `the caller's lifecycle ${hold.lifecycleUid} (name "${name}") is retiring; a retiring incarnation's credential holds no control authority (F5)`;
+                return `the caller's lifecycle ${hold.target.lifecycleUid} (name "${name}") is retiring; a retiring incarnation's credential holds no control authority (F5)`;
         }
         if (this.retiredPrincipals.has(caller))
             return "the caller's lifecycle is retired; a retired incarnation's credential holds no control authority (F5)";
@@ -9189,26 +9265,8 @@ export class Manager {
     async withProvisioner(fn) {
         if (!this.auth)
             throw new Error("withProvisioner: no space auth (an open mesh has no scoped creds)");
-        const identity = newIdentity();
-        const creds = await mintCreds(this.auth, identity, "provisioner");
-        const prov = new CotalEndpoint({
-            space: this.space,
-            servers: this.servers,
-            channels: [],
-            creds,
-            card: { id: identity.id, name: "provisioner", role: "provisioner", kind: "endpoint" },
-            registerPresence: false,
-            watchPresence: false,
-            watchChannels: false,
-            consume: false,
-        });
-        await prov.start();
-        try {
-            return await fn(prov);
-        }
-        finally {
-            await prov.stop();
-        }
+        // Onboarding runs several provisioning ops, so it keeps the provisioner profile's five-minute window.
+        return withScopedEndpoint({ space: this.space, servers: this.servers ?? DEFAULT_SERVER, auth: this.auth }, "provisioner", "provisioner", fn, 5 * 60);
     }
     /** A connection holding this instance's transfer reader grants (docs/design/resume-transfer.md
      *  section 6) for this one receive or sweep: minted from the space's signing seed, or issued by the